Privacy Policy

Effective Date: July 2, 2026

1. Introduction

GSDVS appreciates your business and trust. We are a Silicon Valley-based company, focused on growing future unicorns. Please read this Privacy Policy. By using our website and services, you consent to the data collection and compliance practices described herein.

2. Legal Basis for Data Processing (GDPR)

Under the General Data Protection Regulation (GDPR), GSDVS processes your personal data only when we have a valid legal basis under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): You have given us clear consent to process your data for a specific purpose (e.g., submitting an application form, a contact form, or accepting tracking cookies).

• Contractual Necessity (Art. 6(1)(b)): Processing is required to fulfill an agreement with you or take necessary steps before entering a contract (e.g., processing founder and startup portfolio applications).

• Legal Obligation (Art. 6(1)(c)): Processing is necessary for compliance with a legal or regulatory obligation to which we are subject.

• Legitimate Interests (Art. 6(1)(f)): Processing helps us secure our website infrastructure against fraudulent activities and analyze traffic to optimize site performance, provided it does not override your fundamental privacy rights.

3. Data Collected & Infrastructure

Data Storage & Cross-Border Data Transfers

GSD Venture Studios operates web servers and cloud databases hosted in the United States. We transfer personal data from the EEA, UK, and Switzerland to our US servers using secure data transfer mechanisms. We rely on the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Where these frameworks do not apply, international data transfers are executed under standard Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data remains fully protected.

Third-Party Data Processors & Sub-Processors

To evaluate startup applications, manage founder relationships, and track portfolio interactions, data is securely processed via the following integrated external platforms:

1. Google Analytics / Google Workspace: For anonymized traffic analytics, behavior tracking, and cloud communication infrastructure.

2. Typeform / Typeform SL: For intake forms, questionnaires, and secure startup application processing.

3. Zapier Inc.: For secure internal database routing and workflow automation.

4. HubSpot Inc. / Salesforce: For customer relationship management (CRM) database storage regarding founders, investors, and partners.

Registration Data

If you register on our website, we store your chosen username, your email address, and any additional personal information added to your user profile. You can see, edit, or delete your personal information at any time (except changing your username). Website administrators can also see and edit this information.

Comments

When you leave comments on the website, we collect the data shown in the comments form, as well as the IP address and browser user agent string to help automated spam detection.

Contact & Application Forms

Information submitted through our application or contact forms is routed to our secure infrastructure under the compliance frameworks mentioned above. These submissions are utilized for evaluation and customer service purposes; they are never shared with unauthorized third parties.

4. Embedded Content

Pages on this site may include embedded content, like YouTube videos, for example. Embedded content from other websites behaves in the exact same way as if you visited the other website directly.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website. Below you can find a list of the services we use:

• Facebook: The Facebook page plugin is used to display our Facebook timeline on our site. Facebook has its own cookie and privacy policies over which we have no control. There is no installation of cookies from Facebook and your IP is not sent to a Facebook server until you consent to it. See their policy here: Facebook Privacy Policy.

• YouTube: We use YouTube videos embedded on our site. YouTube has its own cookie and privacy policies over which we have no control. There is no installation of cookies from YouTube and your IP is not sent to a YouTube server until you consent to it. See their policy here: YouTube Privacy Policy.

5. Cookies

This site uses cookies – small text files that are placed on your machine to help the site provide a better user experience. In general, cookies are used to retain user preferences, store information for secure authentication, and provide anonymized tracking data to third-party applications like Google Analytics. You can customize or withdraw your consent at any time using the cookie banner controls on our interface.

Necessary Cookies (All site visitors)

• __cfduid: Used by our CDN CloudFlare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. See CloudFlare Privacy Policy.

• PHPSESSID: Used to identify your unique session on the website.

Necessary Cookies (Additional for Logged-In Users)

• wp-auth: Used by WordPress to authenticate logged-in visitors, password authentication, and user verification.

   

• wordpress_logged_in_{hash}: Used by WordPress to authenticate logged-in visitors, password authentication, and user verification.

   

• wordpress_test_cookie: Used by WordPress to ensure cookies are working correctly.

   

• wp-settings-[UID]: Used to customize your view of the admin interface, and possibly also the main site interface.

• wp-settings-time-[UID]: Used to customize your view of the admin interface, and possibly also the main site interface.

6. Who Has Access To Your Data

If you are not a registered client for our site, there is no personal information we can retain or view regarding yourself. If you are a client with a registered account, your personal information can be accessed by:

• Our core system administrators.

   

• Our support operators when they (in order to provide support) need to extract information about the client accounts and access.

We do not share, sell, or disclose your personal data to third parties for marketing purposes.

7. Data Retention Policy

We enforce clear retention limits to ensure data is not stored indefinitely:

• Form Submissions & Startup Applications: Form entries, pitch materials, and technical metadata are retained for a maximum period of 12 months for tracking and review purposes, after which they are permanently deleted or anonymized unless a formal acceleration agreement is initiated.

• Analytics & Third-Party Tracking Data: Anonymized user behavior data tracked via Google Analytics and associated tracking pixels is retained for a maximum period of 14 months before automatic deletion.

• Comments: When you submit a comment, its metadata is retained indefinitely. We use this data so that we can recognize you and approve your comments automatically instead of holding them for moderation.

• Account Data: If you register on our website, we store the personal information you provide in your user profile for as long as the account remains active. You can see, edit, or delete your personal information at any time (except changing your username).

8. Security Measures & Breach Protocols

We use the SSL/HTTPS protocol throughout our site. This encrypts our user communications with the servers so that personally identifiable information is not captured/hijacked by third parties without authorization.

In case of an unexpected data breach, system administrators will immediately take insulation steps within 72 hours, will contact affected users via email, and will trigger automated password resets if security is compromised.

9. Your Rights Under GDPR

GSDVS fully supports and adheres to the European General Data Protection Regulation (GDPR) standards. If you are a resident of the European Union or United Kingdom, you possess the following explicit legal rights regarding your data:

• Right of Access (Art. 15): You can request a clear, exported copy of all personal data we retain about you.

• Right to Rectification (Art. 16): You can request immediate corrections to inaccurate, incomplete, or out-of-date personal information.

• Right to Erasure / ‘Right to be Forgotten’ (Art. 17): You can request that we erase any of your stored personal data. This does not include data we are legally obliged to keep for administrative, tax, financial audit, or security verification purposes.

• Right to Restriction of Processing (Art. 18): You have the right to restrict how we process your personal data under certain conditions.

• Right to Data Portability (Art. 20): You can request a copy of your records in a structured, commonly used, machine-readable format to transfer to another provider.

• Right to Object (Art. 21): You have the right to object to the processing of your data based on legitimate interests or direct marketing fields.

• Rights Related to Automated Decision-Making (Art. 22): You have the right not to be subject to decisions based solely on automated processing or profiling that produce legal consequences.

How to Exercise Your Rights

To submit a formal data access, modification, or erasure request under the GDPR, please contact our compliance desk directly via email at: privacy@gsdvs.com. We will verify your identity to safeguard your account data and complete your request within 30 days.

How to Lodge a Complaint

You possess the explicit legal right to lodge a formal complaint with a supervisory Data Protection Authority (DPA) within your local EU/UK jurisdiction if you believe our data processing operations violate compliance standards.

10. Third-Party Websites

GSDVS may post links to third-party websites on this website. These third-party websites are not screened for privacy or security compliance by GSDVS, and you release us from any liability for the conduct of these third-party websites. All social media sharing links or icons do not connect you to any associated third parties unless you explicitly click on them. GSDVS bears no responsibility for the information collected or used by any advertiser or third-party website.

11. Release of Your Data for Legal Purposes

At times it may become necessary or desirable to GSDVS, for legal purposes, to release your information in response to a request from a government agency or a private litigant. You agree that we may disclose your information to a third party where we believe, in good faith, that it is desirable to do so for the purposes of a civil action, criminal investigation, or other legal matter. Any passing on of personal data for legal purposes will only be done in strict compliance with the data protection laws of the country you reside in.

12. Data Controller & Contact Details

For questions regarding this Privacy Policy or our compliance operations, please contact our Legal Compliance Division:

Entity: GSD Venture Studios LLC

Physical Headquarters: 68 Willow Road, Menlo Park, California, 94025, United States

Email Contact: privacy@gsdvs.com